BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.2.1.1 PIV Card Application PIN and Global PIN

NIST PIV and digital identity SP 800-73-5 against SP 800-73-4
All changes in this version
modified 3 PIV Card Application Card Command Interface part of 3.2.1

Title

PIV Card Application PIN and Global PIN

Control changed

Before · SP 800-73-4

If the key reference is '00' or '80' and the authentication data in the command data field does not satisfy the criteria in Section 2.4.3 , then the card command shall fail and the PIV Card Application shall return either the status word '6A 80' or '63 CX'. If status word '6A 80' is returned, the security status and the retry counter of the key reference shall remain unchanged. 7 If status word '63 CX' is returned, the security status of the key reference shall be set to FALSE and the retry counter associated with the key reference shall be decremented by one.

If the authentication data in the command data field is properly formatted (see previous paragraph) and does not match reference data associated with the key reference, then the card command shall fail, the PIV Card Application shall return the status word '63 CX', the security status of the key reference shall be set to FALSE, and the retry counter associated with the key reference shall be decremented by one.

If the card command succeeds, then the security status of the key reference shall be set to TRUE and the retry counter associated with the key reference shall be set to the reset retry value associated with the key reference. The initial value of the retry counter and the reset retry value associated with the key reference, i.e., the number of successive failures (retries) before the retry counter associated with the key reference reaches zero, are issuer dependent.

6 There is no retry counter associated with the pairing code, and so the authentication method cannot be blocked for that key reference.

After · SP 800-73-5

If the key reference is '00' or '80' and the authentication data in the command data field does not satisfy the criteria in SectionSec. 2.4.3 , then the card command shallSHALL fail, and the PIV Card Application shallSHALL return either the status word '6A 80' or '63 CX'. If status word '6A 80' is returned, the security status and the retry counter of the key reference shallSHALL remain unchanged. 78

8 It is recommended that in this case the authentication data not be compared to the on-card reference data. If status word '63 CX' is returned, the security status of the key reference shallSHALL be set to FALSE, and the retry counter associated with the key reference shallSHALL be decremented by one.

If the authentication data in the command data field is properly formatted (see previous paragraph) and does not match reference data associated with the key reference, then the card command shallSHALL fail, the PIV Card Application shallSHALL return the status word '63 CX', the security status of the key reference shallSHALL be set to FALSE, and the retry counter associated with the key reference shallSHALL be decremented by one.

 If the card command succeeds, then the security status of the key reference shallSHALL be set to TRUE, and the retry counter associated with the key reference shallSHALL be set to the reset retry value associated with the key reference. The initial value of the retry counter and the reset retry value associated with the key reference, (i.e., the number of successive failures (/retries) before the retry counter associated with the key reference reaches zero, are issuer dependent.

6 There) is no retry counter associated with the pairing10 code,or andless sofor theboth authenticationkey methodreferences cannotin beaccordance blockedwith forFIPS that201, keySection reference2.9.3.